Function is_deterministically_refused_syscall 

pub fn is_deterministically_refused_syscall(sysno: Sysno) -> bool

Returns whether Detcore deterministically refuses sysno with a fixed errno when the fail-closed policy is active, without consulting the host.

A backend that lets a guest execute a syscall outside Detcore’s handle_syscall_event dispatcher consults this to enforce the same fixed refusal the ptrace path enforces. The only production consumer is the DBT copied pre-exec child policy in detcore-dbt, which runs without a Detcore tool; the KVM backend, like ptrace, delivers these syscalls to handle_syscall_event. It deliberately excludes emulated / no-op / host-forwarding families (credential no-ops, timer_create, AF_UNIX autobind), because fail-closing a copied child for those would diverge from the ptrace path rather than match it.